SBI data breach: 3,897 customer records exposed on dark web, bank confirms
Synopsis
India's largest bank, SBI, has confirmed that 3,897 customer records — including names, mobile numbers, addresses, and loan metadata — were found on the dark web after hacker group 'Siriusim' claimed access to 3.75 lakh entries. With CERT-In and the Defence Cyber Agency already involved, the breach has escalated into a national-level cyber incident, even as SBI insists day-to-day operations remain unaffected.
Key Takeaways
State Bank of India (SBI) confirmed on 21 October 2026 that 3,897 customer records containing PII were found exposed on the dark web .
The bank's preliminary analysis covered approximately 3.75 lakh (375,000) records found online; the confirmed exposure is 3,897 records .
Exposed data reportedly includes names, mobile numbers, dates of birth, email and residential addresses, CIF identifiers , and loan/lead metadata.
Hacker group 'Siriusim' earlier claimed possession of 3.75 lakh data entries in CSV format and 2,722 PDF documents linked to SBI.
Alerts were received from SBI's Threat Intelligence Service Provider, the Defence Cyber Agency , and CERT-In ; an independent CERT-In-empanelled agency is now investigating.
SBI stated the breach has no material impact on business operations; shares traded flat at ₹970 on the BSE on Wednesday.
State Bank of India (SBI), the country's largest public sector lender, on Wednesday, 21 October 2026, confirmed a data breach in which 3,897 customer records containing Personally Identifiable Information (PII) were found exposed on the dark web. The disclosure came via an exchange filing after SBI received alerts from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In earlier in the week.
What Was Exposed
According to SBI's exchange filing, the compromised data reportedly includes customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata linked to loan and lead records. The 3,897 affected records were identified during a preliminary analysis of approximately 3.75 lakh (375,000) records available on the dark web — underscoring that the wider dataset under scrutiny is significantly larger than the confirmed exposure.
How the Breach Came to Light
Earlier in the week, an unidentified hacker group operating under the name 'Siriusim' claimed to have obtained confidential customer information allegedly linked to SBI, including personal details, loan applications, and account-opening documents. The group purportedly possesses 3.75 lakh data entries in CSV format and 2,722 PDF documents associated with the bank. The claim was highlighted by cybersecurity monitoring account CyberPulse56 in a post on social media platform X. SBI subsequently received formal alerts from its threat intelligence provider and government agencies before initiating its own probe.
SBI's Response and Containment Measures
The bank said it promptly activated its cyber incident response and containment protocols upon receiving the alerts. An independent CERT-In-empanelled cybersecurity agency has been engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise. A detailed investigation is underway to establish the authenticity and completeness of the exposed data, determine its potential source and extent, and assess associated risks.
Notably, SBI stated that the incident does not have any material impact on its core business operations, financial performance, or business continuity, and that core functions continue to operate normally without disruption. The bank added that appropriate remedial and preventive measures are being implemented.
Market Reaction
Shares of SBI traded on a flat note at ₹970 at around 10 am on the Bombay Stock Exchange (BSE) on Wednesday, suggesting markets have not yet priced in significant operational risk from the incident. The stock's 52-week high stands at ₹1,234.80 and its 52-week low at ₹891.55. The scrip has declined approximately 12% over the past one year, though it has gained over the last five years.
Broader Context
This is not an isolated incident in India's banking sector. Data breaches at financial institutions have become an escalating concern as lenders digitalise loan origination, account opening, and customer onboarding — processes that generate and store large volumes of PII. The involvement of government agencies like the Defence Cyber Agency and CERT-In in the alert chain signals that the breach was treated as a matter of national-level cyber vigilance from the outset. With the investigation still underway, the full scope of the exposure — and whether any data has been actively misused — remains to be established.
Point of View
Government agency coordination, independent forensic engagement — but the optics are difficult. A preliminary scan of 3.75 lakh dark web records confirming nearly 3,900 are genuine SBI customer entries is not a reassuring floor; it may be an early ceiling before the full investigation concludes. The data typology is particularly sensitive: mobile numbers, dates of birth, residential addresses, and loan metadata together create a rich profile for phishing and social-engineering attacks, even if no financial credentials were directly exposed. The flat share price reaction suggests markets are treating this as a disclosure event rather than a systemic risk — but that calculus could shift if the investigation widens the confirmed exposure. India still lacks a fully enforced personal data protection regime, which means affected customers have limited formal recourse even when a breach is confirmed.
NationPress
21 Oct 2026
Frequently Asked Questions
What happened in the SBI data breach?
State Bank of India confirmed on 21 October 2026 that 3,897 customer records containing Personally Identifiable Information were found exposed on the dark web. The bank received alerts from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In before initiating a formal investigation.
What customer information was exposed in the SBI breach?
The exposed data reportedly includes registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata linked to loan and lead records. No financial credentials such as passwords or account numbers have been confirmed as compromised at this stage.
Who is behind the SBI data breach?
An unidentified hacker group operating under the name 'Siriusim' claimed to have obtained the data, reportedly possessing 3.75 lakh entries in CSV format and 2,722 PDF documents linked to SBI. The claim was surfaced by cybersecurity monitoring account CyberPulse56 on social media platform X; SBI and government agencies are investigating its authenticity.
Has the SBI data breach affected banking services or customers' money?
SBI has stated that the incident has no material impact on its core business operations, financial performance, or business continuity, and that core functions are operating normally. However, customers whose PII may have been exposed are at heightened risk of phishing and social-engineering attempts.
What is SBI doing to address the data breach?
SBI has activated its cyber incident response and containment protocols and engaged an independent CERT-In-empanelled cybersecurity agency for a comprehensive assessment. A detailed investigation is underway to verify the authenticity of the exposed data, determine its source, assess risks, and implement remedial and preventive measures.
